For vibe coders · Your app, your VPS
Your site works. But is the database open to everyone? Is Node out of date? The free PatchFirst check gives you a rating and highlights your stack without finding details. Specific vulnerabilities and what to patch first are part of paid monitoring.
One command on your own server. No root (admin) access needed. Monitoring is paid. Annual billing saves 20%: one server for a year is $28.80 instead of $36.00. First 5 servers: $3.00 each per month; from server 6: $2.00; from server 26: $1.50.
Start with specific questions about your server. PatchFirst collects software versions and signs of service exposure, then checks them against known issues.
A database or Redis service exposed to the internet could put user data at risk. Paid PatchFirst monitoring flags databases, Redis, and other services that appear visible from the internet, so you can check access first.
A version was picked at setup. Someone may have found a flaw in it since. PatchFirst checks Node.js and other identified software against known vulnerabilities; detailed findings and urgent updates are available in paid monitoring.
A stranger’s miner could take over your VPS and run up your bandwidth bill. Attackers can get in through outdated software with a known hole, or a service open to everyone. Paid PatchFirst monitoring shows exactly that: what’s outdated and what’s visible from the internet.
Get a rating, component names and installed versions with severity highlights, and general blind spots for free. Vulnerability details are not included.
01 / Check
Run the command on your own server. The agent runs without root access. Python is optional. Check requirements →
curl -fsSL https://patchfirst.dev/check.sh | sh02 / Understand
Highlights show finding severity: critical, high, medium, low, or clean. Components without findings are collapsed, and general blind spots show the limits of the check.
03 / Act
Specific vulnerabilities and what to patch first are part of paid monitoring. Your dashboard adds detailed findings, fixed versions, and work priorities.
The agent collects technical information about software and services. It doesn’t need the contents of your application’s database.
Before upload, the agent removes the server address and replaces its names with random labels; only you can see the real names. When name encryption is enabled, the name dictionary is encrypted separately; its decryption key isn’t sent to the service.
During analysis, the service sees software, versions, and technical details. The connection IP is used only in memory for brute-force protection and is not retained. Anonymized inventories and reports are stored in PostgreSQL in readable form for the service. Backups use a separate recipient encryption key.
Yes: PHP packages from composer.lock, Node.js dependencies from npm, Yarn and pnpm, and Python packages from pip and poetry when exact versions are available. Checks include direct and transitive dependencies; dev dependencies stay in the report with a label. Ruby, Go, Rust and Java are not supported yet.
For Node.js, the agent reads package-lock.json, yarn.lock and pnpm-lock.yaml; for Python, poetry.lock, Pipfile.lock, uv.lock, requirements*.txt entries with ==, and metadata from installed packages in discovered venv/site-packages. Missing or floating versions cannot be checked. Collection is bounded by access permissions, time, file and package counts; reached limits appear as blind spots.
You can leave names unset: the dashboard will show “Server 01”. You can also choose an alias such as web-1: it is stored openly. Do not enter a domain, IP address, company or customer name. For protection, enable name encryption in Account: your browser will move existing names into an encrypted dictionary and the service will delete the open copies.
Start with your own VPS
Check one server for free: a rating and highlighted stack without finding details. Regular checks are part of paid monitoring. Annual billing saves 20%: one server for a year is $28.80 instead of $36.00. First 5 servers: $3.00 each per month; from server 6: $2.00; from server 26: $1.50.